ETSITS125 467V8.1.0 



(2009-04) 



Technical Specification 



Universal Mobile Telecommunications System (UMTS); 

UTRAN architecture for 3G Home NodeB; 

Stage 2 
(3GPP TS 25.467 version 8.1.0 Release 8) 



JtSiP 





3GPP TS 25.467 version 8.1 .0 Release 8 1 ETSI TS 1 25 467 V8.1 .0 (2009-04) 



Reference 



RTS/TSGR-0325467V81 
Keywords 



UMTS 



ETSI 

650 Route des Lucioles 
F-06921 Sophia Antipolis Cedex - FRANCE 

Tel. : +33 4 92 94 42 00 Fax: +33 4 93 65 47 1 6 

Siret N ° 348 623 562 0001 7 - NAF 742 C 
Association a but non lucratif enregistree a la 
Sous-Prefecture de Grasse (06) N° 7803/88 



Important notice 



Individual copies of the present document can be downloaded from: 
http://www.etsi.orq 

The present document may be made available in more than one electronic version or in print. In any case of existing or 

perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). 

In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive 

within ETSI Secretariat. 

Users of the present document should be aware that the document may be subject to revision or change of status. 

Information on the current status of this and other ETSI documents is available at 

http://portal.etsi.orq/tb/status/status.asp 

If you find errors in the present document, please send your comment to one of the following services: 

http://portal.etsi.orq/chaircor/ETSI support.asp 

Copyright Notification 

No part may be reproduced except as authorized by written permission. 
The copyright and the foregoing restriction extend to reproduction in all media. 

© European Telecommunications Standards Institute 2009. 
All rights reserved. 

DECT™, PLUGTESTS™, UMTS™, TIPHON™, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered 

for the benefit of its Members. 
2QppTM |g g jracle Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. 

LTE™ is a Trade Mark of ETSI currently being registered 

for the benefit of its Members and of the 3GPP Organizational Partners. 

GSM® and the GSM logo are Trade Marks registered and owned by the GSM Association. 



ETSI 



3GPP TS 25.467 version 8.1 .0 Release 8 2 ETSI TS 1 25 467 V8.1 .0 (2009-04) 



Intellectual Property Rights 



IPRs essential or potentially essential to the present document may have been declared to ETSI. The information 
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found 
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in 
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web 
server ( http://webapp.etsi.org/IPR/home.asp ). 

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee 
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web 
server) which are, or may be, or may become, essential to the present document. 



Foreword 

This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under 
http://webapp.etsi.org/kev/quervform.asp . 



ETSI 



3GPP TS 25.467 version 8.1 .0 Release 8 3 ETSI TS 1 25 467 V8.1 .0 (2009-04) 



Contents 



Intellectual Property Rights 2 

Foreword 2 

Foreword 5 

1 Scope 6 

2 References 6 

3 Definitions, symbols and abbreviations 6 

3.1 Definitions 6 

3.2 Abbreviations 6 

4 Overall architecture 7 

4.1 General 7 

4.1.1 HNB Management System (HMS) 7 

4.1.2 Security Gateway (SeGW) 7 

4.1.3 HNB Gateway (HNB-GW) 8 

4.1.4 HNB 8 

4.2 Functional split 8 

5 UTRAN functions for HNB access 10 

5.1 UE Registration 10 

5.1.1 General 10 

5.1.2 UE Registration: case of non CSG UEs or non CSG HNBs 1 1 

5.1.3 UE Registration: case of CSG UEs and CSG HNBs 12 

5.2 HNB Registration 13 

5.2.1 General 13 

5.2.2 HNB Registration procedure 13 

5.3 HNB-GW Discovery Function 15 

5.3.1 General 15 

5.4 HNB de-registration Function 15 

5.4.1 General 15 

5.5 luh Disconnect 15 

5.5.1 General 15 

5.5.2 luh Disconnect procedure 16 

6 Requirements for O&M 17 

6.1 O&M for HNB 17 

6.1.1 Provisioning Procedure for HNB 17 

6.1.2 Location Verification 17 

6.1.2.1 General 17 

6.1.2.2 Macro-cell Information 17 

6.1.2.2.1 General 17 

6.1.2.2.2 UTRAN Cell Information 18 

6.1.2.2.3 GSM Cell Information 18 

6.1.2.3 GNSS Location Information 18 

6.1.2.4 Broadband Connection Information 19 

6.1.3 HNB-GW Discovery 19 

6.1.4 HNB Provisioning 19 

6.1.4.1 General 19 

6.1.4.2 CN Level Parameters 20 

6.1.4.3 RAN Level Parameters 21 

6.1.4.4 RF Level Parameters 22 

6.2 O&M for HNB GW 22 

7 luh interface protocol structure 23 

7.1 General 23 

7.2 luh 23 



£75/ 



3GPP TS 25.467 version 8.1 .0 Release 8 4 ETSI TS 1 25 467 V8.1 .0 (2009-04) 

Annex A (informative): Change History 25 

History 26 



£75/ 



3GPP TS 25.467 version 8.1 .0 Release 8 5 ETSI TS 1 25 467 V8.1 .0 (2009-04) 



Foreword 



rd , 



This Technical Specification has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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1 Scope 

The present document specifies the UTRAN architecture for 3G Home NodeB (HNB). 

It covers specification of the functions for UEs not supporting Closed Subscriber Groups (CSG) (i.e.pre-Rel-8 UEs) and 
UEs supporting CSGs. It also covers HNB specific requirements for O&M. 

2 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TR 21.905: "Vocabulary for 3GPP Specifications". 

[2] 3GPP TS 25.468: "UTRAN luh Interface RUA signalling". 

[3] 3GPP TS 25.469: " UTRAN luh Interface HNBAP signalling ". 

[4] 3GPP TS 25.401 : "UTRAN overall description". 

[5] 3GPP TS 25.410: "UTRAN lu Interface: general aspects and principles". 

[6] IETF RFC 4960 (September 2007): "Stream Control Transmission Protocol" . 

[7] Broadband Forum TR-069 Amendment 2, CPE WAN Management Protocol, Broadband Forum 

Technical Report, 2007. 

3 Definitions, symbols and abbreviations 

3.1 Definitions 

For the purposes of the present document, the terms and definitions given in TR 21.905 [1] and the following apply. A 
term defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905 [1]. 

Home NodeB, 3G Home NodeB: These terms, their derivations and abbreviations are used synonymously throughout 
this document. 

3.2 Abbreviations 

For the purposes of the present document, the abbreviations given in TR 21.905 [1] and the following apply. An 
abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in 
TR 21.905 [1]. 

CSG Closed Subscriber Group 

DSL Digital Subcriber Line 

DSL-GW DSL GateWayGNSS Global Navigation SatelHte System 

GPS Global Positioning System 

HMS Home NodeB Management System 
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HNB 


3G Home NodeB 


HNB-GW 


3G HNB Gateway 


HW 


Hard Ware 


IP 


Internet Protocol 


LAC 


Local Area Code 


RAC 


Routing Area Code 


RGW 


Residential Gate Way 


SAC 


Service Area Code 


SeGW 


Security GateWay 


sw 


Soft Ware 



Overall architecture 



4.1 



General 



The overall UMTS architecture and UTRAN architectures are described in 25.401 and 25.410. For clarity and ease of 
understanding, at appropriate places references to TR-069 and associated methods are described briefly although they 
are beyond the scope of this specification. 

The reference model shown in Figure 4.1-1 below contains the network elements that make up the HNB access 
network. There is one-to-many relationship between HNB-GW and HNB(s). 



Uu 




luh 



Security 
Gateway 



HNBGW 



HMS 



Figure 4.1-1. luh reference model. 

The HNB GW serves the purpose of a RNC presenting itself to the CN as a concentrator of HNB connections. The lu 
interface between the CN and the HNB-GW serves the same purpose as the interface between the CN and a RNC. One 
HNB serves only one cell. 

NOTE: The Security gateway is a logically separated entity and may be implemented either as a separate physical 
element or integrated into, for example, a HNB-GW. 

The HNB access network includes the functional entities as shown in Figure 4.1-1 and detailed below. 

4.1 .1 HNB Management System (HMS) 

Based on TR-069 family of standards [7] 

- Facilitates HNB-GW discovery 

Provisions configuration data to the HNB 

Performs Location verification of HNB and assigns appropriate serving elements (HMS, Security Gateway and 
HNB-GW). 



4.1 .2 Security Gateway (SeGW) 

Terminates Secure tunnelling for TR-069 [7] as well as luh 
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- Authentication of HNB 

- Provides access to HMS and HNB-GW 

4.1 .3 HNB Gateway (HNB-GW) 

Terminates luh from HNB. Appears as a RNC to the existing Core network using existing lu interface. 
Provides service to the HNB 

4.1.4 HNB 

Customer Premise Equipment that offers the Uu Interface to the UE 

Provides the RAN connectivity using the luh interface 

Supports RNC like functions, the details of which are captured in table 4.2-1 below 

- Supports HNB registration and UE registration over luh. 



4.2 Functional split 



The UTRAN functions in the HNB are supported by RANAP, whereas the HNB specific functions are supported by 
Home NodeB Application Protocol (HNBAP) between the HNB and the HNB GW. The HNB GW provides 
concentration function for the control plane and may provide concentration function for the user plane. 

This sub-clause defines the functional split between the core network and the UMTS radio access network. The 
functional split is shown in table 4.2-1 and 4.2-2 
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Table 4.2-1. Functional split for UTRAN function in the HNB access. 



Function 


HNB 


HNBGW 


CN 


RAB management functions: 








RAB establishment, modification and release 


X 


FFS 


X 


RAB characteristics mapping lu transmission bearers 


X 


X 




RAB characteristics mapping Uu bearers 


X 






RAB queuing, pre-emption and priority 


X 




X 


Radio Resource Management functions: 








Radio Resource admission control 


X 






Broadcast Information 


X 




X 


lu link IVIanagement functions: 








lu signalling link management 


X 


X 


X 


ATM VC management 




X 


X 


AAL2 establish and release 




X 


X 


AAL5 management 




X 


X 


GTP-U Tunnels management 


X 


X 


X 


TCP IVIanagement 


X (FFS) 


(X)™'^ 1 


X 


Buffer Management 


X 


X 




lu U-plane (RNL) Management: 








lu U-plane frame protocol management 






X 


lu U-plane frame protocol initialization 


X 






Mobility management functions: 








Location information reporting 


X 




X 


Handover and Relocation 
Inter RNC hard HO, lur not used or not available 
Serving RNS Relocation (intra/inter MSC) 
Inter system hard HO (UMTS-GSM) 








X 


PPgNote^ 


X 


X (FFS) 




X 


X 


FFS™'"'* 


X 


Inter system Change (UMTS-GSM) 


X 


FFS 


X 


Paging Triggering 


X 




X 


GERAN System Information Retrieval 


X 




X 


Security Functions: 








Data confidentiality 
Radio interface ciphering 
Ciphering key management 
User identity confidentiality 








X 










X 


X 




X 


Data integrity 
Integrity checking 
Integrity key management 








X 










X 


Service and Network Access functions: 








CN Signalling data 


X 




X 


Data Volume Reporting 


X 






UE Tracing 


X 




X 


Location reporting 


X 


PPgiwe. 


X 


lu Co-ordination functions: 








Paging co-ordination 


X 




X 


NAS Node Selection Function 




X 




MOCN Rerouting Function 




y Note b 


X 


HNB Registration™'^^ 








HNB Registration Function 


X 


X 




HNB-GW Discovery Function 


X 






HNB de-registration Function 


X 


X 




UE Registration for HNB """^^ 








UE Registration Function for HNB 


X 


X 




UE de-registration Function for HNB 


X 


X 




luh user-plane Management functions 








luh User plane transport bearer handling 


X 


X 




Note 1 : If TCP is terminated for lu-BC in the HNB GW 

Note 2: Protocol support for this group of functions is provided by the HNB Application Protocol. 

Note 3: Whether it is possible (and may be necessary) to provide location information from the HNB GW 

(e.g. GW may have logic to derive location based on the public IP address of the HNB GW, etc), is 

FFS 
Note 4: Support for relocation from the macro network to HNB is FFS. 
Note 5: Support for MOCN feature is FFS. 
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Table 4.2-2. Functional split for HNB function in the HNB access. 



Function 


HNB 


HNBGW 


HNB Registration""'^' 






HNB Registration Function 


X 


X 


HNB-GW Discovery Function 


X 




HNB de-registration Function 


X 


X 








UE Registration for HNB "°'^' 






UE Registration Function for HNB 


X 


X 


UE de-registration Function for HNB 


X 


X 








luh user-plane IVIanagement functions 






luh User plane transport bearer handling 


X 


X 


Note 1 : Protocol support for this group of functions is provided by the HNB 
Application Protocol. 



5 UTRAN functions for HNB access 

5.1 UE Registration 



5.1.1 



General 



The UE Registration Function for HNB provides means for the HNB to convey UE identification data to the HNB-GW 
in order to perform access control for the UE in the HNB GW. The UE Registration also informs the HNB-GW of the 
specific HNB where the UE is located. 

The following sections illustrate the case when the HNB registers a specific UE with the HNB-GW. The registration is 
triggered when the UE attempts to access the HNB via an initial NAS message (e.g.., Location Updating Request) and 
there is no context in the HNB allocated for that UE. 
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5.1 .2 UE Registration: case of non CSG UEs or non CSG HNBs 





HNBGW 



1. RRC Connection Est. UE identity, UE Rel, UE Cap, 



3. Optional Identity request 



2. RRC Initial Direct Transfer 



(e.g. LU Request,...) 



Check Release, 
UE Capabilities 



4. Optional Access 
Control (IMSI, HNB) 



5. UE Registration Req (UE id(jntity, UE Rel, UE Cap,..) 




6. Access Control 
(IMSI, HNB) 



7. UE Registration Accept (Cor text-id,..) 



8. Connect (Initial UE Message;, .. ) 



9. SCCP CR (Initial UE Message, .. ) 



10. SCCPCC 



1 1 . Continue with NAS procedure 



Figure 5.1.2-1. UE Registration for pre Rel-8 UEs. 

1. Upon camping on the HNB, the UE initiates an initial NAS procedure (e.g. LU Procedure) by establishing an 
RRC connection with the HNB. UE identity, UE capabilities, e.g. "Access stratum release indicator" or "UE 
feature capability indicator" (FES) and Establishment Cause, are reported to the HNB as part of the RRC 
Connection establishment procedure (step 1). 

2. The UE then transmits a RRC Initial Direct Transfer message carrying the initial NAS message (e.g. Location 
Updating Request message) with some form of UE identity . 

3. The HNB checks UE capabilities provided in step 1, if these indicate that CSG is not supported and if the 
identity of the UE (provided during RRC Connection Establishment) is unknown at the HNB being accessed, i.e. 
no Context id exists for the UE, the HNB initiates UE registration towards HNB-GW (step 5-7). Before starting 
the UE Registration procedure, HNB triggers the Identification procedure (step 3) asking for the UE IMSI, if 
such identity is not provided during the RRC Connection Establishment in case it is not an emergency call.. If 
the HNB has a context id for the UE, the UE registration procedure is not performed nor the Identification 
procedure. 

4. The HNB may optionally perform access control based on IMSI and provided access control list 

5. The HNB attempts to register the UE on the HNB-GW by transmitting the UE REGISTER REQUEST. The 
message contains at a minimum: 

- UE Identity: IMSI or TMSI of the (U)SIM associated with the UE and the indication about UE capabilities 
provided in step 1 . 

NOTE: The UE Identity provided in the HNBAP UE REGISTER REQUEST message is unauthenticated. 

6. The HNB-GW checks the UE capabilities and the Registration Cause. If these indicate that CSG is not supported 
and that it is not an Emergency Call, the HNB-GW shall perform access control (step 6) for the particular UE 
attempting to utilize the specific HNB. 
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7. If the HNB-GW accepts the UE registration attempt it shall allocate a context-id for the UE and respond with an 
HNBAP UE REGISTER ACCEPT message, including the context-id, to the HNB. If the HNB-GW chooses to 
not accept the incoming UE registration request then the HNB-GW shall respond with an HNBAP UE 
REGISTER REJECT message. The HNB behaviour for reject handling shall further be determined by the cause 
specified in the HNBAP UE REGISTER REJECT message (FFS). 

8. The HNB then sends an RUA CONNECT message containing the RANAP Initial UE message. 

9. The reception of the RUA CONNECT message at the HNB-GW triggers the setup of SCCP connection by the 
HNB-GW towards the CN. HNB-GW forwai'ds the RANAP Initial UE Message. 

10. The CN responds with an SCCP Connection Confirm message. 

1 1. The UE continues with the NAS procedure (e.g. Location Updating procedure) towards the CN, via the HNB 
and the HNB-GW. 

NOTE: The HNB-GW may additionally utilize a CN assisted method (e.g. using IMSI provided in the 

COMMON ID message) to alleviate the security risks associated with spoofing of IMSI by the UE and 
subsequently trigger a UE deregistration upon such detection. 

5.1 .3 UE Registration: case of CSG UEs and CSG HNBs 

This call flow assumes that the Core Network is able to perform access control on the basis of Closed Subscriber 
Groups. 



UE 



HNB 



HNBGW 



1. RRC Connection Est. (TMSI or IMSI, UE Rel, UE Cap, ..) 



2. RRC Initial Direct Transfer (e.g. LU Request,...) 



3. Check Release, 
UE Capabilities 



4. UE Registration (TMSI or II /ISI, Rel, UE Cap,.. ) 



CN 



5. Access Control 
(Always accept) 



6. UE Registration Accept (Context-id,..) 



7. Connect (Initial UE Messagfi,.. ) 



10. Optional MM 



8. SCCP CR (Initial UE Message,.. ) 



9. SCCP CC 



11. Access Control 



12. Continue with NAS procedure 



Figure 5.1.3-1. UE Registration for Rel-8 UEs. 

1. Upon camping on the HNB, the UE initiates an initial NAS procedure (e.g. LU Procedure) by establishing an 
RRC connection with the HNB. UE identity and UE capabilities, e.g. "Access stratum release indicator" or "UE 
feature capability indicator" (FFS), are reported to the HNB as part of the RRC Connection estabUshment 
procedure (step 1). 
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2. The UE then transmits a RRC Initial Direct Transfer message carrying the initial NAS message (e.g. Location 
Updating Request message) with some form of identity (e.g. IMSI or TMSI, ..). 

3. The HNB checks UE capabilities provided in step 1, if these indicate that CSG is supported and if the identity of 
the UE (provided during RRC Connection Establishment) is unknown at the HNB being accessed, i.e. no 
Context id exist for the UE, the HNB initiate UE registration towards HNB-GW (step 4-6). If HNB has a context 
id for UE, UE registration procedure is not performed. No Identification procedure is triggered, independent on 
the identity reported by the UE during the RRC Connection Establishment. 

4. The HNB attempts to register the UE on the HNB-GW by transmitting the UE REGISTER REQUEST. The 
message contains at a minimum: 

- UE Identity: IMSI or TMSI of the (U)SIM associated with the UE and the indication about UE capabiUties 
provided in step 1 . 

NOTE: The UE IMSI/TMSI provided in the UE REGISTER message is unauthenticated. 

5. The HNB-GW checks UE capabilities and if these indicate that CSG is supported the HNB-GW shall accept the 
UE registration and allocate a context-id for the UE. 

6. HNB-GW respond with a UE REGISTER ACCEPT message back to the HNB including a context-id allocated 
to the UE 

7. The HNB then sends a CONNECT message containing the RANAP Initial UE message. 

8. The reception of the CONNECT message at the HNB-GW triggers the setup of SCCP connection by the HNB- 
GW towards the CN. HNB-GW forwards the Initial UE Message including the CSG id of HNB. 

9. The CN response with a SCCP Connection Confirm message. 

10. The CN may optionally perform Mobility Management procedures, e.g. Authentication procedure. 

1 1 . The CN performs access control of UE. 

12. After granted access the UE then continue with the NAS procedure (e.g. Location Updating procedure) towards 
the CN, via HNB and the HNB-GW. 

5.2 HNB Registration 

5.2.1 General 

The following section illustrates the case when the HNB registers with the HNB-GW. The HNB registration procedure 
serves the following purposes: 

It informs the HNB-GW that a HNB is now available at a particular IP address. 

5.2.2 HNB Registration procedure 
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HNB 




SeGW 


HNB- 
















I.HNBIn 


tialization 














2. Establish secure tunnel 








3. Establish Reliable Transport Session (e.g. SCTP) 






4. HNB REGISTER REQUEST (Location Information, HNB Identity, HNB Operating Parameters) 






5a. HNB REGISTER ACCEPT (. .) 






<-- 


6b. HNB REGISTER REJECT (Reject Cause) 

















Figure 5.2.2-1. HNB Registration procedure. 

1. HNB initialization is performed to obtain HNB configuration from the HNB Management System (HMS). 
Similarly, HNB-GW discovery is performed to obtain the initial serving HNB-GW information. 

2. The HNB establishes a secure tunnel to the SeGW of the serving HNB-GW. 

NOTE: This step may be omitted if a secure tunnel happens to be the same tunnel that is already established to 
contact the HMS. 

3. The HNB sets up a SCTP transport session to a well-defined port on the serving HNB-GW. 

4. The HNB then attempts to register with the serving HNB-GW using a HNB REGISTER REQUEST message. 
The message contains: 

a. HNB Location Information: The HNB provides location information via use of one or more of the 
following mechanisms: 

i. detected macro-cell coverage information (e.g. GERAN and/or UTRAN cell information) 

ii. geographical co-ordinates (e.g. via use of GPS, etc) 

iii. Internet connectivity information (e.g. IP address), provided, the resulting location information is at least 
as accurate as location determination based on macro-cell coverage information, whether or not there is 
macro cell-coverage available at the location of the HNB (e.g. as determined by point i above). 

b. HNB Identity: the HNB has a globally unique and permanent identity. 

c. HNB Operating Parameters: Such as the selected LAC, RAC, SAC, etc. 

5a. The HNB-GW may use the information from the HNB REGISTER REQUEST message to perform access 
control of the HNB (e.g. whether a particular HNB is allowed to operate in a given location, etc). If the HNB- 
GW accepts the registration attempt it shall respond with a HNB REGISTER ACCEPT message. 

5b. Alternatively, the HNB-GW may reject the registration request (e.g. due to network congestion, blacklisted 
HNB, unauthorized HNB location, etc). In this case, the HNB-GW shall respond with a HNB REGISTER 
REJECT indicating the reject cause. 

NOTE: The HNB shall start broadcasting only after successful registration with the HNB-GW. 
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5.3 HNB-GW Discovery Function 
5.3.1 General 

The HNB-GW Discovery Function provides the means to determine the address of the Serving HNB-GW for a 
particular HNB. The HNB will use the Serving HNB GW address to register with the Serving HNB-GW. 

5.4 HNB de-registration Function 
5.4.1 General 

Editors Note: To be added. 

5.5 luh Disconnect 
5.5.1 General 

The following section illustrates the scenario where an UE-associated signaling connection is released across the luh. In 
this scenario the HNB is responsible for initiating the release of the UE-associated signaling connection via the RUA 
disconnect message. The HNB-GW is then responsible for co-ordinating the release of the UE-associated signaling 
connection with the corresponding lu connection, which will be triggered by the CN. 
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5.5.2 luh Disconnect procedure 



UE 



HNB 



HNB-GW 



CN 



1 . Establish Connection between UE and Networl< 



3. RUA Direct Transfer (Context- 
Id, CN Domain Id , RANAP 
lu Release Command ) 



4. Release RRC Connection 



5. RUA Disconnect (Context-ID 
CN Domain ID , RANAP lu Releasfe 
Complete) 



9. (opt) HNBAP UE 
De-register (IIVISI) 



2. SCCP:DT1 (RANAP 
lu Release Command) 



6. SCCP:DT1 (RANAP 
lu Release Complete) 



7. SCCP: RLSD 



8. SCCP: RLC 



1. Establish connection between UE and network. Procedure in Section 5.1. 

2. CN sends a RANAP Release lu connection command message to the HNB-GW 

3. HNB-GW forwards this message to the relevant HNB 

4. HNB triggers the release of the RRC connection to the UE. In this case a single lu connection had been 
established for the UE 

5. HNB sends a Disconnect message to the HNB-GW to indicate that this is the end of this particular UE- 
associated signaling connection and includes the RANAP Release lu Connection Complete message. 

6. HNB-GW forwards the RANAP message onto the CN. 

7. CN triggers the release of the associated SCCP connection 

8. HNB-GW confirms that the SCCP connection is released 

9. Optionally the HNB can de-register the UE context from the HNB-GW. 
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Requirements for O&M 



6.1 



O&M for HNB 



6.1 .1 Provisioning Procedure for HNB 



HNB 

tit: 



Security 
Gateway 



HMS 



HNBGW 



1. Establish Secure tunnel 



2. Location verification, HNB GW discovery, 
HNB Provisioning using TR-069 



r T' 

3. Reliable Transport setup (SCTP) 



4. HNB Registration procedure commences 



Figure 6.1.1-1. Provisioning procedure for l-INB. 

1 . A secure tunnel is established from the HNB to the Security gateway. 

2. Location verification shall be performed by the HMS based on information sent by the HNB (e.g. macro 
neighbour cell scans, global navigational satellite system type of information etc.). HMS determines the serving 
elements and provides the HNB GW, HMS and Security Gateway to the HNB. The HMS also provisions 
configuration parameters to the HNB only after successful location verification in the HMS. 

NOTE: Steps 3 & 4 are shown only for completeness. Security Gateway and HMS are shown to highlight the 
general architecture. 

NOTE: In the event information required for verifying location are not available (for example, no macro 

neighbour cells, no GNSS, no DSL line ID etc. available), HNB GW discovery may be based on specific 
operator and/or regulatory policies. 

6.1.2 Location Verification 



6.1.2.1 



General 



During the location verification, HNB reports its location information to the HMS. HMS in turn examines the provided 
information and verifies HNB's location. There are 3 possible types of information for this purpose: 

1 . Macrocell Information 

2. GNSS location information 

3. Broadband connection information, provided, the resulting location information is at least as accurate as location 
determination based on macro-cell coverage information, whether or not there is macro-cell coverage available 
at the location of the HNB (e.g. as determined by point I. above). 

NOTE: Not all of this information is mandatory. In fact, the type of reported information is based on factors such 
as physical environmental condition the HNB is installed and/or possible variations in the HNB's HW 
and SW implementation. 



6.1.2.2 



Macro-cell Information 



6.1.2.2.1 



General 



The HNB is expected to have a radio environment measurement capability. This includes capturing the following type 
of information from the surrounding environment. 



£75/ 



ETSI TS 125 467 V8.1.0 (2009-04) 



3GPP TS 25.467 version 8.1 .0 Release 8 18 

a) UTRAN cell information 

RF level information 
Broadcast information 

b) GSM cell information 

RF level information 
Broadcast information 

6.1 .2.2.2 UTRAN Cell Information 

The information in the following table is reported by the HNB to the HMS for each UTRAN cell detected. 

Table 6.1.2.2.2.-1. UTRAN Cell Information. 



Information 


Description / Note 


Presence 


3GPP Reference 


RF 
information 


UARFCNDL 


UARFCN (DL) 


M 


25.104, sec.5.4 
32.642 sec. 6.3.11 


CPICHRSCP 


RSCP of CPICH 


M 




PSC 


Primary Scrambling Code 


M 


32.642 sec. 6.3.11 


Broadcast 
information 


PLMN Type 


« GSM-MAP » or « ANSI-41 » 


M 


25.331, 
sec.10.3.1.12 


MCC 


IVlobile Country Code 


M 


24.008 

32.642 sec. 6.3.10 


MNC 


Mobile Network Code 


M 


24.008 

32.642 sec. 6.3.10 


LAC 


Location Area Code 


M 


24.008, 

sec.1 0.5.1. 3 32.642 

sec. 6.3.10 


RAG 


Routing Area Code 


M 


24.008, 

sec.10.5.1.12.3 
25.413, sec.9.2.3.7 
32.642 sec. 6.3.10 


CelllD 


Cell ID 


M 


25.331, 
sec.1 0.3.2.2 


CSG Cell Info 


<detail TBD per Rel.8 RRC 
speo 





Applicable to Rel.8 
compliant cell only. 



6.1.2.2.3 GSM Cell Information 

The information in the following table is reported by the HNB to the HMS for each GSM cell detected. 

Table 6.1.2.2.3. GSM Cell Information. 



Information 


Description / Note 


Presence 


3GPP Reference 


RF 
information 


ARFCN 


Channel number 


M 


32.652 sec. 6.3.5 


BCCHRSSI 


RSSI of the BCCH carrier. 


M 


32.652 sec. 6.3.5 


BSIC 


Base Station ID Code 


M 


32.652 sec. 6.3.5 


Broadcast 
Information 


MCC 


Mobile Country Code 


M 


32.652 sec. 6.3.5 


MNC 


Mobile Network Code 


M 


32.652 sec. 6.3.5 


LAC 


Location Area Code 


M 


32.652 sec. 6.3.5 


RAC 


Routing Area Code 


M 


32.652 sec. 6.3.5 


CelllD 


Cell ID 


M 


32.652 sec. 6.3.5 



6.1.2.3 



GNSS Location Information 



This information consists of, at minimum, latitude and longitude detected by the GNSS receiver (e.g. GPS receiver), if 
the HNB implementation includes this functionality. 
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6.1.2.4 



Broadband Connection Information 



This information consists of the information associated with the broadband connection (e.g. DSL) the HNB is 
connected with: 1) pubHc IP address assigned to the RGW (e.g. DSL-GW/router), and 2) Hne identifier to which the 
RGW is connected with (e.g. DSL Hne ID) as seen on the broadband service provider. These are applicable only when 
this information is available to the HNB, and only when the resulting location information is at least as accurate as 
location determination based on macro-cell coverage information, whether or not there is macro-cell coverage available 
at the location of the HNB (e.g. as determined by clause 6.1.2.2 above). 

6.1.3 HNB-GW Discovery 

During the HNB-GW Discovery procedure, HMS provides the HNB with 3 identity information as shown in the 
following table. The information may be either IP address or FQDN to be resolved by DNS. 

Table 6.1.3. HNB-GW Discovery Information. 



Parameter 


Description / Note 


Presence 


3GPP Reference 


Serving HMS ID 


One or more IDs may be provided 


M 




Serving SeGW ID 


One or more IDs may be provided 


M 




Serving HNB-GW ID 


One or more IDs may be provided 


M 





6.1.4 HNB Provisioning 



6.1.4.1 



General 



During the HNB Provisioning procedure, the HMS transfers the HNB configuration information to the HNB. This 
includes 3 types of parameters: 

1 . CN level parameters 

2. RAN level parameters 

3. RF level parameters 

NOTE: The HNB may have auto-configuration capabilities, such that the HMS sends a list/range of values to the 
HNB, which selects (and returns to HMS) a single value, also based on the information collected 
measuring the radio environment. The HMS may also provide control parameters of the auto- 
configuration process. 
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6.1.4.2 



CN Level Parameters 



Table 6.1.4.2. CN Level Parameters. 



Parameter 


Description / Note 


Presence 


3GPP Reference 


PLMN Type 


"GSM-MAP"or"ANSI-41" 


M 


25.331, sec.10.3.1. 12 


MCC 


Mobile Country Code 


M 


24.008 

32.642 sec. 6.3.8 


MNC 


Mobile Network Code 


M 


24.008 

32.642 sec. 6.3.8 


LAC 


Location Area Code (one or more LACs 
may be provided) 


M 
(Note 1) 


24.008, sec.1 0.5.1. 3 
32.642 sec. 6.3.9 


SAC 


Service Area Code 


M 


25.413, sec.9.2.3.9 
32.642 sec. 6.3.9 


1321 2 


Periodic LAU timer (CS domain) 


M 


24.008, sec.10.5.1. 12.2 


ATT 


Attach-detach allowed (CS domain) 


M 


24.008, sec.10.5.1. 12.2 


RAC 


Routing area code (PS domain) (one or 
more RACs may be provided) 


M 
(Note 1) 


24.008, sec.10.5.1. 12.3 
25.413, sec.9.2.3.7 
32.642 sec. 6.3.9 


NMO 


Network Mode of Operation (Gs i/f) 


M 


24.008, sec.10.5.1. 12.3 


Equivalent PLMN ID 


List of one or more equivalent PLMN ID 
(MCC + MNC) 




(Note 2) 


24.008, sec.10.5.1. 13 


Allowed IMSI list 


For access control purpose. 




(Note 3) 


24.008, sec.1 0.5.1. 4 


CSG Cell Info 


CSG Capability Indication, 

CSG Id, in case the Cell is CSG capable 

<any further detail FFS per Rel.8 RRC 

speo 


M 


Applicable to Rel.8 
compliant cell only. 


HNB Location 
Information 


Location information (Geographical 
coordinates, Uncertainty code) 


0(FFS 
Note 4) 


25.413, sec.9.2.3.11 


NOTE 1 : May be a list/range of values in case the HNB has auto-configuration capabilities. 

NOTE 2: This information is operator-dependent based on its circumstance. 

NOTE 3: ACL is an optional function at HNB. This information is provided if this function is enabled in 

the HNB. 
NOTE 4: Due to possible regulatory requirements (future or current), this parameter may become 

mandatory. 
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6.1.4.3 



RAN Level Parameters 



Table 6.1.4.3-1. RAN Level Parameters. 



Parameter 


Description 


Presence 


3GPP Reference 


RNClDforHNB 


RNC ID used by HNB 


M 


32.642 sec. 6.3.8 


Cell ID 




28-bit "Cell ID"inSIB3 


M 


25.331, 
sec.10.3.2.2 


HSPA related 


HSflag 


Whether 

HSDPA/HSUPA is used 
or not 


Q 


32.642-820 
32.642 sec. 6.3.9 


HCS related 


UseOfHCS 

HCSPrio 

QHCS 




M 


25.331, 
sec.1 0.3.7.47, 
10.3.7.12 
32.642 sec. 6.3.9 


Cell selection 


Quality measure 


CPICH Ec/NO or RSCP 


Q 


25.331, 


/ reselection 


QqualMin 


if Ec/NO is used 


(Note*1) 


sec. 10. 3. 2. 3, 


related 


QqualMin-offset 






10.3.2.4 




QrxlevMin 


if RSCP is used 




32.642 sec. 6.3.9 




QrxlevMin-offset 






25.304 




Sintrasearch 










Sintersearch 










SsearchRAT 










SsearchHCS 










Treselections 










UETxPwrMaxRACH 










QHystI 








Intra Freq 


Filter coefficient 


Filter coefficient 


Q 


25.331 


Measurement 


Measurement quantity for freq 


CPICH Ec/No, CPICH 


(Note*1) 


sec.1 0.3.7.38, 


Related 


quality estimate 
Hysteresis for event 1x 
Threshold for event 1x 
TimetoTrigger for event 1x 
Weighting factor for event 1x 
Reporting Range 
Triggering Condition 


RSCP, or pathless 
"x" in 1x includes 
applicable events from 
1Ato U 




10.3.7.39 


Inter-Freq 


Filter coefficient 


Filter coefficient 


Q 


25.331 


Measurement 


Measurement quantity for freq 


CPICH Ec/No, CPICH 


(Note*1) 


sec.10.3.7.18. 


Related 


quality estimate 
Hysteresis for event 2x 
Threshold for event 2x 
TimetoTrigger for event 2x 
Weighting factor for event 2x 


RSCP 

"x" in 2x includes 
applicable events from 
2A to 2F 




10.3.7.19 


Inter-RAT 


Filter coefficient 


Filter coefficient 





25.331 


Measurement 


BSIC verification required 


"required" / "not 


(Note*1) 


sec.10.3.7.29, 


Related 


Hysteresis for event 3x 
Threshold for event 3x 
TimetoTrigger for event 3x 
Weighting factor for event 3x 


required" 
"x" in 3x includes 
applicable events from 
3A to 3D 




10.3.7.30 


RRC related 


N30x, N31x 


RRC constants 


Q 


25.331, 




T30x, T31x, T320 


RRC timers 


(Note*1) 


sec.1 0.3.3.43, 
10.3.3.44 


Neighbour list 


RNCID 


Defined for each intra- 


Q 


32.642 sec. 6.3.10 


(UTRA Intra- 


C-ld 


freq cells 


(Note*2) 


25.401 sec. 6.1 


Freq cell info 


LAC 


C-ld is either 12 or 16 




25.413 sec. 


list) 


RAC 
PSC 


bits depending on 
RNCID length. 




9.2.1.28 


Neighbour list 


RNCID 


Defined for each inter- 


Q 


32.642 sec. 6.3.10 


(UTRA Inter- 


C-ld 


freq cells 


(Note*2) 


25.401 sec. 6.1 


Freq cell info 


LAC 


C-ld is either 12 or 16 




25.413 sec. 


list) 


RAC 

UARFCN (DL) 
PSC 


bits depending on 
RNCID length 




9.2.1.28 
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Neighbour list 
(GERAN cell 
info list) 



CellD 
BSIC 

Bandlndicator 
BCCHARFCN 



Defined for each inter- 
RAT cells (assume GSM 
cell only). 



O 
(Note*2) 



32.652 sec. 6.3.5 



Note (*1): Marked as optional based on the operator preference on the extent of provisioning that the HMS 

performs to the HNB vs. the level of autonomy that HNB has for auto-configuration. In case this IE is 
absent, default value is assumed (additional implication is that HNB has a set of default parameter 
values). 

Note (*2): Marked as optional due to several implications: 1 ) there may be no suitable neighbour cell available 
based on the RF scanning procedure described earlier, 2) based on operator deployment policy (e.g. 
dedicated RF channel for HNB layer vs. macro layer), and 3) operator preference on the extent of 
provisioning that the HMS performs to the HNB vs. the level of autonomy that HNB has for auto- 
configuration. Regarding 3) above, this may include capabilities such as the HMS to add or remove 
neighbour cells initially detected by the HNB during the radio environment scanning process, and the 

HNB to extend the received Neighbour list based on auto-configuration capabilities. 



6.1.4.4 



RF Level Parameters 



Table 6.1.4.4. RF Level Parameters. 



Parameter 


Description / Note 


Presence 


3GPP Reference 


UARFCN (DL) 


Frequency channel number (one or more 
UARFCNs may be provided) 



(note 1) 


25.101, sec.5.4, 
25.104, sec.5.4, 
32.642, sec.6.3.11 


PSC 


Primary scrambling code (one or more 
PSGs may be provided) 



(note 1) 


32.642, sec.6.3.11 


MaxHNBTxPower 


Maximum allowed Tx power of the HNB. 




(note 1) 


25.104, sec.6.2, 
32.642, sec.6.3.9 


MaxULTxPower 


The parameter defines the maximum 
transmission power level a UE can use on 
PRAGH. 



(note 1) 


25.101, sec.6.2, 
32.642, sec.6.3.9 


P-GPICHPower 


Transmission power of Primary GPIGH (DL 
config). This may be either a specific value 
or a range (min / max) of values. 




(note 1) 


32.642, sec.6.3.11 


P-SCHPower 


Primary SGH power offset (DL config) 



(note 1) 


32.642, sec.6.3.11 


S-SCHPower 


Secondary SGH power offset (DL config) 




(note 1) 


32.642, sec.6.3.11 


BCHPower 


BGH power offset (DL config) 



(note 1) 


32.642, sec.6.3.11 


AlCHPower 


AIGH power offset (DL config, BGGH info) 



(note 1) 


25.331, 
sec. 10. 3. 6. 3, 
32.642, sec.6.3.11 


PICHPower 


PIGH power offset (DL config, BGGH info) 




(note 1) 


25.331, 
sec.10.3.6.50, 
32.642, sec.6.3.9 


PCHPower 


PGH power offset (DL config, BGGH info) 



(note 1) 


32.642, sec.6.3.9 


FAG H Power 


FAGH power offset (DL config, BGGH info) 




(note 1) 


32.642, sec.6.3.9 


NOTE 1 : Marked as optional based on the operator preference on the extent of provisioning that the 
HMS performs to the HNB vs. the level of autonomy that HNB has for auto-configuration. In 
case this IE is absent, it is assumed that the HNB will derive the suitable value based on its 
auto-configuration capability. In case this IE is a list/range of values, the HNB will choose a 
single value based on its auto-configuration capability. UARFCN UL may be automatically 
determined by the HNB upon UARFGN DL (basing on standard duplex configuration and 
country-specific spectrum allocation). 



6.2 O&M for HNB GW 



Editors Note: FFS 
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luh interface protocol structure 



7.1 General 

Figure 7.2-1 shows luj, the Control Plane as well as the User Plane protocol structure over the luh interface. For the 
control plane, the HNBAP protocol provides the signalling service between the HNB and the HNB-GW required to 
fulfil the following functions and is further described in 25.469 [3]: 

- HNB Registration 

UE Registration 

Error Handling. This function allows the reporting of general error situations for which function specific error 
messages have not been defined. 

RUA provides the signalling service between the HNB and the HNB-GW that is required to fulfil the following 
functions and is further described in 25.468 [2]: 

Transparent transfer of RANAP messages 

Error Handling. This function allows the reporting of general error situations for which function specific error 
messages have not been defined. 

The payload protocol identifier (PPl) field in SCTP [6] is set to the value assigned by lANA for use with the RUA 
protocol. In addition, a separate value for the PPl is defined for HNBAP. 

The destination port number field in SCTP [6] is set to the value assigned by lANA for setup of the common SCTP 
association in HNBAP and RUA. 

7.2 luh 

Figure 7.2-1 shows the protocol structure for luh, following the structure described in [5]. 



£75/ 



3GPP TS 25.467 version 8.1.0 Release 8 



24 



ETSI TS 125 467 V8.1.0 (2009-04) 









1 






Radio 1 


Control Plane 


1 User Plane 




Network 
Layer 


RANAP 


HNBAP 










lu UP Protocol 
Layer **) 




1 
1 


RUA i 




^-.-J.-y. 




/>[ 1 


, I 




1 ^ 


f 








1 


1 






1 










Transport i j 

Network | [ 

Layer ] I 


Transport 
User 

1 


Network 
Plane 

r 


' 1 Transport Network I 
■ 1 Control Plane (void) I 


Transport 
User 


Network i 
Plane 1 








I ICS: RTF/ PS: GTP-U 
. ; RTCP*) 

1 1 1 r 




SCTP 


] I uDP/ip ; 1 


IP 




1 


' [ 
1 










Date Link 




1 1 Data Link j I 
1 1 II 




1 1 






! ■ II 




1 ' 


1 1 Physical Layer ! 1 [ ■ j 




1 I 






1 


1 








1 1 1 















*) RTCP is optional. 

**) lu UP is terminated in CN and HNB only (i.e. not in the HNB GW) 

Figure 7.2-1. luh-lnterface Protocol Stack. 
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